FAQ o OpenWrt | Sprzedam różne routery | Oddam

2025-01-19 21:59:25

Cześć, udało Ci się, bo widzę, że temat ciekawy i sam chętnie bym się dokształcił w połączeniu Openwrt z HE przez ubus

2024-10-26 18:22:49

to gdzie mam to zmienić?

2024-10-26 17:50:58

znalazłem, dzięki za naprowadzenie zmieniłem w network wan na wwan0
network.wan=interface
network.wan.device='wwan0'
network.wan.proto='dhcp'
network.wan.metric='40'
network.wan.ip6assign='0'
network.wwan0=interface
network.wwan0.device='LTE'

2024-10-26 17:42:41

restart pbr z konsoli
[0;31mERROR[0m: The pbr 1.1.6-22 service failed to discover WAN gateway!

2024-10-26 17:38:24

Sat Oct 26 18:37:30 2024 user.notice pbr [5223]: Using wan interface (on_boot): wan
Sat Oct 26 18:37:30 2024 user.notice pbr [5223]: service waiting for wan gateway...
Sat Oct 26 18:37:31 2024 user.notice pbr [5223]: Using wan interface (on_boot): wan
Sat Oct 26 18:37:31 2024 user.notice pbr [5223]: service waiting for wan gateway...

2024-10-26 17:33:25

poprawiłem na LTE

network.loopback=interface
network.loopback.device='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fdbf:75d0:c5e2::/48'
network.globals.packet_steering='1'
network.@device[0]=device
network.@device[0].name='br-lan'
network.@device[0].type='bridge'
network.@device[0].ports='lan1 lan2'
network.@device[1]=device
network.@device[1].name='br-iot'
network.@device[1].type='bridge'
network.@device[1].ports='lan3 lan4'
network.@bridge-vlan[0]=bridge-vlan
network.@bridge-vlan[0].device='br-lan'
network.@bridge-vlan[0].vlan='1'
network.@bridge-vlan[0].ports='lan1:u*' 'lan2:u*'
network.@bridge-vlan[1]=bridge-vlan
network.@bridge-vlan[1].device='br-iot'
network.@bridge-vlan[1].vlan='2'
network.@bridge-vlan[1].ports='lan3:u*' 'lan4:u*'
network.lan=interface
network.lan.type='bridge'
network.lan.device='br-lan.1'
network.lan.proto='static'
network.lan.ipaddr='192.168.1.1'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='0'
network.lan.ipv6='0'
network.lan.disable_ipv6='1'
network.iot=interface
network.iot.type='bridge'
network.iot.device='br-iot.2'
network.iot.proto='static'
network.iot.ipaddr='192.168.2.1'
network.iot.netmask='255.255.255.0'
network.iot.dns='1.1.1.1 1.0.0.1'
network.iot.ipv6='0'
network.iot.disable_ipv6='1'
network.iot.ip6assign='0'
network.wan=interface
network.wan.device='LTE'
network.wan.proto='dhcp'
network.wan.metric='40'
network.wan.ip6assign='0'
network.wan6=interface
network.wan6.device='LTE'
network.wan6.proto='dhcpv6'
network.wan6.reqaddress='try'
network.wan6.reqprefix='auto'
network.LTE=interface
network.LTE.proto='mbim'
network.LTE.device='/dev/cdc-wdm0'
network.LTE.apn='internet'
network.LTE.auth='none'
network.LTE.pdptype='ipv4'
network.LTE.ipv6='0'
network.LTE.ip6assign='0'
network.LTE.dns='8.8.8.8' '1.1.1.1'
network.ProtonVPN=interface
network.ProtonVPN.proto='none'
network.ProtonVPN.device='tun0'
network.ProtonVPN.ip6assign='0'

poprawiłem
w pbr
config policy 'iot_policy'
option interface 'LTE'
option local_addresses '192.168.2.0/24'
option name 'iot'

config policy 'lan_policy'
option interface 'ProtonVPN'
option local_addresses '192.168.1.0/24'
option name 'lan'
i nadal ten sam komunikat

2024-10-26 17:12:28

network.loopback=interface
network.loopback.device='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fdbf:75d0:c5e2::/48'
network.globals.packet_steering='1'
network.@device[0]=device
network.@device[0].name='br-lan'
network.@device[0].type='bridge'
network.@device[0].ports='lan1 lan2'
network.@device[1]=device
network.@device[1].name='br-iot'
network.@device[1].type='bridge'
network.@device[1].ports='lan3 lan4'
network.@bridge-vlan[0]=bridge-vlan
network.@bridge-vlan[0].device='br-lan'
network.@bridge-vlan[0].vlan='1'
network.@bridge-vlan[0].ports='lan1:u*' 'lan2:u*'
network.@bridge-vlan[1]=bridge-vlan
network.@bridge-vlan[1].device='br-iot'
network.@bridge-vlan[1].vlan='2'
network.@bridge-vlan[1].ports='lan3:u*' 'lan4:u*'
network.lan=interface
network.lan.type='bridge'
network.lan.device='br-lan.1'
network.lan.proto='static'
network.lan.ipaddr='192.168.1.1'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='0'
network.lan.ipv6='0'
network.lan.disable_ipv6='1'
network.iot=interface
network.iot.type='bridge'
network.iot.device='br-iot.2'
network.iot.proto='static'
network.iot.ipaddr='192.168.2.1'
network.iot.netmask='255.255.255.0'
network.iot.dns='1.1.1.1 1.0.0.1'
network.iot.ipv6='0'
network.iot.disable_ipv6='1'
network.iot.ip6assign='0'
network.wan=interface
network.wan.device='wan'
network.wan.proto='dhcp'
network.wan.metric='40'
network.wan.ip6assign='0'
network.wan6=interface
network.wan6.device='wan'
network.wan6.proto='dhcpv6'
network.wan6.reqaddress='try'
network.wan6.reqprefix='auto'
network.LTE=interface
network.LTE.proto='mbim'
network.LTE.device='/dev/cdc-wdm0'
network.LTE.apn='internet'
network.LTE.auth='none'
network.LTE.pdptype='ipv4'
network.LTE.ipv6='0'
network.LTE.ip6assign='0'
network.LTE.dns='8.8.8.8' '1.1.1.1'
network.ProtonVPN=interface
network.ProtonVPN.proto='none'
network.ProtonVPN.device='tun0'
network.ProtonVPN.ip6assign='0'

2024-10-26 16:59:45

ifconfig
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:xxx.xx.xxx.xx.. P-t-P:xxx.xxx.xxx.xx Mask:255.255.0.0
inet6 addr: xxxxxxxxx Scope:Link
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:51999 errors:0 dropped:0 overruns:0 frame:0
TX packets:33643 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:55036903 (52.4 MiB) TX bytes:7182959 (6.8 MiB)

wan Link encap:Ethernet HWaddr xxxxxxxxxxxx
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:22

wwan0 Link encap:Ethernet HWaddr CE:DE:56:7E:CC:57
inet addr:xx.xx.xxx.xxx Bcast:xxx.xxxx.xxx.xxx Mask:255.255.255.252
inet6 addr: fe80::ccde:xxxxxxxxxxx/64 Scope:Link
UP BROADCAST RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:52140 errors:0 dropped:0 overruns:0 frame:0
TX packets:33745 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:57765064 (55.0 MiB) TX bytes:8942417 (8.5 MiB)

2024-10-26 16:50:59

może tutaj jest problem przez vlany?

2024-10-26 16:49:05

{
"up": false,
"pending": false,
"available": true,
"autostart": true,
"dynamic": false,
"proto": "dhcp",
"device": "wan",
"data": {

}

2024-10-26 16:41:48

policy
config policy 'iot_policy'
option interface 'wan'
option local_addresses '192.168.2.0/24'
option name 'iot'

config policy 'lan_policy'
option interface 'ProtonVPN'
option local_addresses '192.168.1.0/24'
option name 'lan'

komunikat
[0;31mERROR[0m: The pbr 1.1.6-22 service failed to discover WAN gateway!

2024-10-26 08:37:54

czy tak to powinno wyglądać?

config pbr 'config'
option enabled '1'
option verbosity '2'
option strict_enforcement '1'
option resolver_set 'none'
list resolver_instance '*'
option ipv6_enabled '0'
list ignored_interface 'vpnserver'
option boot_timeout '30'
option rule_create_option 'add'
option procd_boot_delay '30'
option procd_reload_delay '20'
option webui_show_ignore_target '0'
option nft_rule_counter '0'
option nft_set_auto_merge '1'
option nft_set_counter '0'
option nft_set_flags_interval '1'
option nft_set_flags_timeout '0'
option nft_set_policy 'performance'
list webui_supported_protocol 'all'
list webui_supported_protocol 'tcp'
list webui_supported_protocol 'udp'
list webui_supported_protocol 'tcp udp'
list webui_supported_protocol 'icmp'
list supported_interface 'tun0'
list supported_interface 'wan'

config rule
option src 'iot'
option proto 'all'
option family 'ipv4'
option table '100'

config rule
option src 'iot'
option dest '0.0.0.0/0'
option target 'wan'
option proto 'all'

bo mam komunikat
Sat Oct 26 09:27:12 2024 user.notice pbr [10522]: Using wan interface (on_start): wan
Sat Oct 26 09:27:12 2024 user.notice pbr [10522]: service waiting for wan gateway...
za wan już podstawiałem wwan0, LTE, wan
może czegoś jeszcze nie wskazałem?

2024-10-26 07:51:56

firewall
pingi na 192.168.2.1 idą a na 1.1.1.1 już nie
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
option flow_offloading '1'
option flow_offloading_hw '1'

config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option mtu_fix '1'
option masq6 '1'
option masq '1'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
list network 'LTE'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Odpowiadanie na Ping z WAN'
option src 'wan'
option proto 'icmp'
option family 'ipv4'
option target 'ACCEPT'
option limit '10/sec'
list icmp_type 'echo-request'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option limit_burst '1000'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option limit_burst '1000'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config zone
option name 'iot'
list network 'iot'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option mtu_fix '1'
option masq '1'

config rule
option name 'Blokada IoT do LAN'
option src 'iot'
option dest 'lan'
option target 'REJECT'

config rule
option name 'Izolacja miedzy IoT '
option src 'iot'
option dest 'iot'
option target 'REJECT'

config rule
option name 'Dostep LAN to IoT'
option src 'lan'
option dest 'iot'
option target 'ACCEPT'

config include
option enabled '1'
option type 'script'
option path '/etc/firewall.user'
option fw4_compatible '1'

config rule
option name 'Dostep zarzadzenie WWW przez LAN'
option src 'lan'
option proto 'tcp'
option dest_port '80 443'
option target 'ACCEPT'

config rule
option name 'Blokada zarzadzania WWW z WAN'
option src 'wan'
option proto 'tcp'
option dest_port '80 443'
option target 'DROP'

config rule
option name 'Limit SSH Brute Force'
option src 'lan'
option dest_port '22'
option proto 'tcp'
option target 'ACCEPT'
option limit '3/min'
option limit_burst '5'

config rule
option name 'Blokada IP dziwnych adresow'
option src 'iot'
option dest 'wan'
option target 'REJECT'
list dest_ip '114.114.114.114'
list dest_ip '76.223.57.190'
list dest_ip '18.156.17.158'
list dest_ip '3.66.31.43'
list dest_ip '169.254.5.6'
list dest_ip '18.194.150.179'
list dest_ip '18.198.15.161'

config zone
option name 'VPN'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
list network 'ProtonVPN'

config forwarding
option src 'lan'
option dest 'VPN'

config rule
option name 'Dostep IoT to WAN'
option src 'iot'
option dest 'wan'
option target 'ACCEPT'
option family 'ipv4'

config forwarding
option src 'iot'
option dest 'wan'

2024-10-25 22:03:19

Cezary chcę zmienić tak, aby IOT wychodziło bezp na WAN
config forwarding
option src 'iot'
option dest 'VPN'
zmieniłem na
config forwarding
option src 'iot'
option dest 'wan'
ale jak zapodaję ip route show to tak jakbym miał wszystko wymuszone przez vpn i nie pinguje mi się np. 1.1.1.1
lokalne pingi działają
0.0.0.0/1 via xx.xx.0.1 dev tun0
default via xx.xx.xxx.102 dev wwan0
xx.xx.xxx.100/30 dev wwan0 scope link src xx.xx.xxx.101
xx.xx.0.0/16 dev tun0 scope link src xx.xx.xx.5
128.0.0.0/1 via xx.xx.0.1 dev tun0
xx.xx.xxx.218 via xx.xx.xxx.102 dev wwan0
192.168.1.0/24 dev br-lan.1 scope link src 192.168.1.1
192.168.2.0/24 dev br-iot.2 scope link src 192.168.2.1

co musiałbym zmienić jeszcze, aby iot (192.168.2.1) szło na wan bezpośrednio?

2024-10-15 19:22:08

Cześć Cezary, chciałem się dowiedzieć czy stosujecie vpn dla urządzeń iot czy raczej nie jest to konieczne - pod iot mam videorejestrator, odkurzacz i domofon

2024-10-15 19:02:47

Cześć, mam sieć skonfigurowaną (23.05) w ten sposób:
router 4 fizyczne porty - podzielone na dwie sieci przez vlan
sieć domowa - interfejs lan spięty z lan 1 i lan 2 oraz interfejs iot spięty z lan 3 i lan4 po vlanie, do tego dwie sieci wifi - rooter spięta z lan oraz iot spięta z iot.
Dodatkowo utworzyłem do tego tunel VPN na OpenVPNie - korzystam z Protona.

I mam pytanie, czy jest możliwość i sens, aby sieć domowa lan była zawsze po VPN a sieć iot wychodziła sonie bezpośrednio na np. wan bez tunelowania. Czy lepiej aby obie szły przez VPN? Jeżeli tak to jak to przerobić - co zmienić w konfiguracji?

Aktualnie lan wychodzi wyłącznie po VPNie, a iot po VPN i Wan, ale jak zapodam dla iot sam wan to nie mam w iot netu.

config forwarding
option src 'lan'
option dest 'VPN'

config forwarding
option src 'iot'
option dest 'VPN'

config forwarding
option src 'iot'
option dest 'wan'

a poniżej całość

network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'xxxxxxxxxxxxx'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1 lan2'

config device
option name 'br-iot'
option type 'bridge'
list ports 'lan3 lan4'

config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'lan1:u*'
list ports 'lan2:u*'

config bridge-vlan
option device 'br-iot'
option vlan '2'
list ports 'lan3:u*'
list ports 'lan4:u*'

config interface 'lan'
option type 'bridge'
option device 'br-lan.1'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '0'
option ipv6 '0'
option disable_ipv6 '1'

config interface 'iot'
option type 'bridge'
option device 'br-iot.2'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
option dns '1.1.1.1 1.0.0.1'
option ipv6 '0'
option disable_ipv6 '1'
option ip6assign '0'

config interface 'wan'
option device 'wan'
option proto 'dhcp'
option metric '40'

config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'

config interface 'LTE'
option proto 'mbim'
option device '/dev/cdc-wdm0'
option apn 'internet'
option auth 'none'
option pdptype 'ipv4'
option ipv6 '0'
option ip6assign '0'
list dns '8.8.8.8'
list dns '1.1.1.1'

config interface 'ProtonVPN'
option proto 'none'
option device 'tun0'

firewall

config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
option flow_offloading '1'
option flow_offloading_hw '1'

config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option mtu_fix '1'
option masq6 '1'
option masq '1'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
list network 'LTE'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
option limit '10/sec'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config zone
option name 'iot'
list network 'iot'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option mtu_fix '1'
option masq '1'

config rule
option name 'Block IoT to LAN'
option src 'iot'
option dest 'lan'
option target 'REJECT'

config rule
option name 'Isolate-IoT-Devices'
option src 'iot'
option dest 'iot'
option target 'REJECT'

config rule
option name 'Allow LAN to IoT'
option src 'lan'
option dest 'iot'
option target 'ACCEPT'

config include
option enabled '1'
option type 'script'
option path '/etc/firewall.user'
option fw4_compatible '1'

config forwarding
option src 'iot'
option dest 'wan'

config rule
option name 'Allow-Management-LAN'
option src 'lan'
option proto 'tcp'
option dest_port '80 443'
option target 'ACCEPT'

config rule
option name 'Deny-Management-WAN'
option src 'wan'
option proto 'tcp'
option dest_port '80 443'
option target 'DROP'

config rule
option name 'Limit-SSH-Brute-Force'
option src 'lan'
option dest_port '22'
option proto 'tcp'
option target 'ACCEPT'
option limit '3/min'
option limit_burst '5'

config rule
option name 'Dla Home Assistanta'
option src 'iot'
option dest_ip '192.168.1.200'
option dest_port '8123'
option proto 'tcp'
option target 'ACCEPT'
option enabled '0'

config rule
option name 'Blokada IP dziwnych adresow'
option src 'iot'
option dest 'wan'
option target 'REJECT'
list dest_ip '114.114.114.114'
list dest_ip '76.223.57.190'
list dest_ip '18.156.17.158'
list dest_ip '3.66.31.43'
list dest_ip '169.254.5.6'
list dest_ip '18.194.150.179'
list dest_ip '18.198.15.161'

config zone
option name 'VPN'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
list network 'ProtonVPN'

config forwarding
option src 'lan'
option dest 'VPN'

config forwarding
option src 'iot'
option dest 'VPN'

2024-10-15 18:42:41

z ciekawości zrobiłem na swoim ASUS RT-AC65p - MT7621

Connecting to host 127.0.0.1, port 5201
[ 5] local 127.0.0.1 port 60022 connected to 127.0.0.1 port 5201
[ ID] Interval Transfer Bitrate Retr Cwnd
[ 5] 0.00-1.00 sec 76.5 MBytes 641 Mbits/sec 0 1.31 MBytes
[ 5] 1.00-2.00 sec 77.9 MBytes 653 Mbits/sec 0 1.31 MBytes
[ 5] 2.00-3.00 sec 74.5 MBytes 625 Mbits/sec 0 1.31 MBytes
[ 5] 3.00-4.00 sec 75.4 MBytes 632 Mbits/sec 0 1.31 MBytes
[ 5] 4.00-5.00 sec 66.9 MBytes 561 Mbits/sec 0 1.31 MBytes
[ 5] 5.00-6.00 sec 75.4 MBytes 632 Mbits/sec 0 1.31 MBytes
[ 5] 6.00-7.00 sec 75.1 MBytes 630 Mbits/sec 0 1.31 MBytes
[ 5] 7.00-8.00 sec 75.6 MBytes 634 Mbits/sec 0 1.31 MBytes
[ 5] 8.00-9.00 sec 70.4 MBytes 590 Mbits/sec 0 1.31 MBytes
[ 5] 9.00-10.00 sec 74.4 MBytes 623 Mbits/sec 0 1.31 MBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bitrate Retr
[ 5] 0.00-10.00 sec 759 MBytes 637 Mbits/sec 0 sender
[ 5] 0.00-10.00 sec 759 MBytes 637 Mbits/sec receiver

2024-10-07 19:26:15

a zrób sobie test
wpisz: 1.1.1.1/help
masz szyfrowany DNS?

2024-08-05 22:48:46

igu35bee napisał/a:

No, oczywiście masz rację. Ja, jeśli chodzi o sieci, jestem tylko samoukiem. Do tego niezbyt zaawansowanym. Mam zatem prośbę o ocenę poprawności opisanej niżej konfiguracji.
Jako że mam trzy osobne WiFi ("zwykłe", dla gości oraz dla IOT), mam też i odpowiadające im strefy firewalla, jak na podlinkowanym screenie:
https://pasteboard.co/qp9oGvPTNfxZ.png
Oprócz tego, aby gościom zapewnić dostęp do DHCP i DNS, mam przekierowanie w Firewall traffic rules:
- Protocol: TCP i UDP
- Source zone: GuestZone
- Destination zone: Device (input)
- Destination port: 53, 67, 68
Do tego zdefiniowane interfejsy z przydzielonymi zakresami IP z puli adresów prywatnych:
- GUEST (Firewall zone: GuestZone)
- IOT (Firewall zone: IOTZone)
oraz sieci WiFi z przypisanymi powyższymi interfejsami.

dlaczego nie masz tam maskarady?
może ktoś mi to wyjaśnić w jakich przypadkach włączać maskowanie na firewallu?

2024-07-28 21:11:19

kawa poszła (●'◡'●)

2024-07-28 21:03:51

poprawiłem wg twoich uwag i poszło )))
tak wygląda uporządkowany plik /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fdbf:75d0:c5e2::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
option vlan_filtering '1'

config device
option name 'br-iot'
option type 'bridge'
list ports 'lan4'
option vlan_filtering '1'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
option ipv6 '0'
option delegate '0'

config interface 'iot'
option device 'br-iot'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
list dns '1.1.1.1'
list dns '8.8.8.8'
option ip6assign '60'
option ipv6 '0'
option delegate '0'

config interface 'wan'
option device 'wan'
option proto 'dhcp'
option metric '40'

config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'

config interface 'LTE'
option proto 'mbim'
option device '/dev/cdc-wdm0'
option apn 'internet'
option auth 'none'
option pdptype 'ipv4'
list dns '8.8.8.8'
list dns '1.1.1.1'

2024-07-28 20:01:01

Cezary napisał/a:

Pierwsze podstawowe pytanie: jakiego ty systemu używasz i w jakiej wersji? swconfig nie ma już dawno na tej platformie więc dlaczego w ogóle masz sekcje z swconfiga w networku? Na dodatek pomieszane z dsa, to jest kompletny bezsens.

twoja wersja 23.05 z 27.07.2024 z Luci
no to namieszałem, od czego zacząć, co usunąć Cezary?

2024-07-28 14:21:21

Cześć, czy możecie mi pomóc w rozwiązaniu problemu:
utworzyłem dwa interfejsy vlan - iot i lan, router asus wif rt-ac65p z 4 portami lan
iot ma podpięty port eth4 na routerze i podłączony jest monitoring po skrętce oraz urządzenia iot po wifi ssid "iot" adresacja 192.168.2.1....
lan ma podpiete porty eth1-3 oraz wifi sieci domowej adresacja 192.168.1.1 wifi ssid "router"
z sieci domowej mam dostęp do do sieci iot czyli z lan do iot
ale mam problem z dostępem do drukarki podłączonej do portu eth1 na routerze w sieci domowej lan - dhcp nadaje jej adres np 192.168.1.35, ale z kompa po wifi domowej "router" nie pinguję jej - nie ma odpowiedzi mając adres na kompie 192.168.1.12
są w tej samej sieci - komp jest połączony po wifi "router" a drukarka jest wpięta do lanu eth1
czego tutaj brakuje?

/etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
option flow_offloading '1'
option flow_offloading_hw '1'

config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
option mtu_fix '1'
option masq6 '1'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
list network 'LTE'

config forwarding
option src 'lan'
option dest 'wan'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config zone
option name 'iot'
list network 'iot'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
option mtu_fix '1'

config forwarding
option src 'iot'
option dest 'wan'

config forwarding
option src 'lan'
option dest 'iot'

config include
option enabled '1'
option type 'script'
option path '/etc/firewall.user'
option fw4_compatible '1'

/etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fdbf:75d0:c5e2::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
option ipv6 '0'
option delegate '0'

config interface 'wan'
option device 'wan'
option proto 'dhcp'
option metric '40'

config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'

config interface 'LTE'
option proto 'mbim'
option device '/dev/cdc-wdm0'
option apn 'internet'
option auth 'none'
option pdptype 'ipv4'

config interface 'iot'
option device 'br-iot'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
list dns '1.1.1.1'
list dns '8.8.8.8'
option delegate '0'

config device
option name 'br-iot'
option type 'bridge'
option bridge_empty '1'
list ports 'eth0.3'
list ports 'lan4'
option ipv6 '0'

config switch_vlan
option device 'switch0'
option vlan '1'
option ports '1 2 3 5t'

config switch_vlan
option device 'switch0'
option vlan '3'
option ports '4 5t'

/etc/config/wireless

config wifi-device 'radio0'
option type 'mac80211'
option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option band '2g'
option htmode 'HT40'
option cell_density '0'
option country 'US'
option noscan '1'
option txpower '20'
option hidden '1'
option channel '6'
option distance '25'

config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'rooter'
option encryption 'sae-mixed'
option key 'xxxxxxxxxxxxxxxx'
option macaddr 'random'
option hidden '1'

config wifi-device 'radio1'
option type 'mac80211'
option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
option channel '36'
option band '5g'
option htmode 'VHT80'
option disabled '1'
option hidden '1'

config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'
option disabled '1'
option hidden '1'

config wifi-iface 'wifinet2'
option device 'radio0'
option mode 'ap'
option ssid 'iot'
option encryption 'sae-mixed'
option isolate '1'
option macaddr 'random'
option key "xxxxxxxxxxxx'
option network 'iot'
option hidden '1'

2024-05-09 21:57:38

można go doinstalować, pojawia się dodatkowa zakładka w network/firewall/crowdsec

Package name Version Size (.ipk) Description
crowdsec 1.6.0-1 52.09 MiB Crowdsec - An open-source, lightweight agent to detect…
Install…
crowdsec-firewall-bouncer 0.0.28-2 4.09 MiB Crowdsec bouncer written in golang for firewalls.…
Install…
lua-cs-bouncer 2022-01-18-e0f68b12-1 27.82 KiB Lua module to allow ip (or not) from CrowdSec API.

Crowdsec - An open-source, lightweight agent to detect and respond to bad behaviours. It also automatically benefits from a global community-wide IP reputation database. This package contains the main program.

Require approx. 52.29 MiB size for 1 package(s) to install.

2024-05-09 20:35:24

Cześć, może ktoś korzystał z tego firewalla?
Ktoś się podzieli jako to skonfigurować?

FAQ o OpenWrt | Sprzedam różne routery | Oddam

Opcje wyszukiwania (Strona 2 z 5)

Znalezione posty: 26 do 50 z 112

26 Odpowiedź przez luckyman 2025-01-19 21:59:25

Odp: Integracja OpenWRT z home assistant (ubus) (6 odpowiedzi, napisanych Oprogramowanie / Software)

27 Odpowiedź przez luckyman 2024-10-26 18:22:49

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

28 Odpowiedź przez luckyman 2024-10-26 17:50:58

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

29 Odpowiedź przez luckyman 2024-10-26 17:42:41

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

30 Odpowiedź przez luckyman 2024-10-26 17:38:24

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

31 Odpowiedź przez luckyman 2024-10-26 17:33:25

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

32 Odpowiedź przez luckyman 2024-10-26 17:12:28

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

33 Odpowiedź przez luckyman 2024-10-26 16:59:45

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

34 Odpowiedź przez luckyman 2024-10-26 16:50:59

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

35 Odpowiedź przez luckyman 2024-10-26 16:49:05

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

36 Odpowiedź przez luckyman 2024-10-26 16:41:48

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

37 Odpowiedź przez luckyman 2024-10-26 08:37:54

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

38 Odpowiedź przez luckyman 2024-10-26 07:51:56

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

39 Odpowiedź przez luckyman 2024-10-25 22:03:19

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

40 Odpowiedź przez luckyman 2024-10-15 19:22:08

Odp: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

41 Temat przez luckyman 2024-10-15 19:02:47

Temat: VLAN DSA + OpenVPN + dwie sieci - domowa i dla iot (25 odpowiedzi, napisanych Oprogramowanie / Software)

42 Odpowiedź przez luckyman 2024-10-15 18:42:41

Odp: Ciekawy test przepustowości iperf3 routera samego ze sobą :) (115 odpowiedzi, napisanych Oprogramowanie / Software)

43 Odpowiedź przez luckyman 2024-10-07 19:26:15

Odp: dnsmasq / adblock/ HTTPS DNS Proxy (10 odpowiedzi, napisanych Oprogramowanie / Software)

44 Odpowiedź przez luckyman 2024-08-05 22:48:46

Odp: Konfiguracja WireGuard, tutorial na YT (8 odpowiedzi, napisanych Oprogramowanie / Software)

45 Odpowiedź przez luckyman 2024-07-28 21:11:19

Odp: VLAN problemy z połączeniem WIFI i LAN (6 odpowiedzi, napisanych Oprogramowanie / Software)

46 Odpowiedź przez luckyman 2024-07-28 21:03:51

Odp: VLAN problemy z połączeniem WIFI i LAN (6 odpowiedzi, napisanych Oprogramowanie / Software)

47 Odpowiedź przez luckyman 2024-07-28 20:01:01

Odp: VLAN problemy z połączeniem WIFI i LAN (6 odpowiedzi, napisanych Oprogramowanie / Software)

48 Temat przez luckyman 2024-07-28 14:21:21

Temat: VLAN problemy z połączeniem WIFI i LAN (6 odpowiedzi, napisanych Oprogramowanie / Software)

49 Odpowiedź przez luckyman 2024-05-09 21:57:38

Odp: Crowdsec (2 odpowiedzi, napisanych Oprogramowanie / Software)

50 Temat przez luckyman 2024-05-09 20:35:24

Temat: Crowdsec (2 odpowiedzi, napisanych Oprogramowanie / Software)

Znalezione posty: 26 do 50 z 112